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Abstract 

Quantum normalizer circuits were recently introduced as generalizations of Clifford 
circuits. A normalizer circuit over a finite Abelian group G is composed of the quantum 
Fourier transform (QFT) over G together with gates which compute quadratic functions 
and automorphisms. In [H it was shown that every normalizer circuit can be simulated 
efficiently classically. This result provides a nontrivial example of a family of quantum 
circuits that cannot yield exponential speed-ups in spite of usage of the QFT — the latter 
being a central quantum algorithmic primitive. Here we extend the aforementioned 
i-C ' result in several ways. Most importantly, we show that normalizer circuits supplemented 

with intermediate measurements can also be simulated efficiently classically, even when 
the computation proceeds adaptively. This yields a generalization of the Gottesman- 
Knill theorem, valid for qubits, to arbitrary G. Moreover our simulations are twofold i.e. 
we show how to classically efficiently sample the measurement probability distributions 
as well as compute the amplitudes of the state vector. Finally we develop a generalization 
of the stabilizer formalism relative to arbitrary finite Abelian groups. For example we 
characterize how to update stabilizers under generalized Pauli measurements and provide 
a normal form of he amplitudes of generalized stabilizer states using quadratic functions 
and subgroup cosets. 

1 Introduction 

Investigating the power of restricted families of quantum circuits is one of the most fruitful 
approaches to understand the fundamental question How does the power of quantum com- 
puters compare to classical ones? A celebrated result in this respect is the Gottesman-Knill 
theorem, which states that any quantum circuit built out of Clifford gates (Hadamards, 
CNOTs, n:/2-phase gates) and Pauli measurements can be efficiently simulated on a classi- 
cal computer ^]^. Thus, a quantum computer that works exclusively with these operations 
cannot achieve exponential quantum speed-ups. 

The Gottesman-Knill theorem illustrates how subtle the frontier between classical and 
quantum computational power can be. For example, even though Clifford circuits can be 
simulated efficiently classically, replacing the Tt/2-phase gates by a Ti/4-phase gate immedi- 
ately yields a quantum universal gate set (s!, [q]. Another interesting feature is that, even 
though the computing power of Clifford circuits is not stronger than classical computation, 
their behavior is genuinely quantum. They can be used, for instance, to prepare highly 
entangled states (such as cluster states 049]), or to perform quantum teleportation Yet 
in spite of the high degrees on entanglement which may be involved, the evolution of Clifford 
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circuits can be tracked efficiently using a Heisenberg picture: i.e. by employing the stabilizer 
formalism used in quantum error correction. 

In this work we study the computational power of normalizer circuits. These circuits 
were introduced in |1] by one of class of quantum computations gen eralizing the 

Clifford circuits, as well as standard extensions of the latter to qudits lul l. A normal- 
izer circuit over a finite Abelian group G is a quantum circuit comprising unitary gates 
that implement the quantum Fourier transform (QFT) over G, quadratic functions of the 
group and automorphisms. If G is chosen to be (i.e. the group of n-bit strings with 
addition modulo 2), normalizer circuits precisely coincide with the unitary Clifford circuits 
(i.e. those composed of CNOT, H and k/2 phase gates). In [l| it was shown that arbitrary 
normalizer circuits (acting on computational basis states and followed by computational 
basis measurements) can be simulated classically efficiently. 

An interesting feature of the normalizer circuit formalism is the presence of QFTs over 
any finite Abelian group. Of particular interest is the group Z2", since its corresponding 
QFT is the "standard" quantum Fourier transform fl; the ktter hes at the core of several 
famous quantum algorithms, such as factoring and computing discrete logarithms More 
generally, QFTs over Abelian groups are central ingredients of quantum algorithms to find 
hidden subgroups of Abelian groups l^-lB]- In contrast with the role of QFTs in quantum 



speed-ups, the normalizer circuit formalism provides a nontrivial example of a family of 
quantum computations that cannot yield exponential speed-ups, in spite of usage of the 
QFT. 

Here we further extend the classical simulation results of [l|]. We do so by considering 
normalizer circuits where intermediate measurements are allowed at arbitrary times in the 
computation — whereas in [l[ only terminal measurements were considered. More precisely 
we define adaptive normalizer circuits over G to comprise the following three fundamental 
ingredients: 

• Normalizer gates over G, i.e. QFTs, automorphism gates, quadratic phase gates. 

• Measurements of generalized Pauli operators over G at arbitrary times in the com- 
putation. 

• Adaptiveness: the choice of normalizer gate at any time may depend (in a polynomial- 
time computable way) on the outcomes obtained in all previous measurement rounds. 

If G is chosen to be Zg, the corresponding class of adaptive normalizer circuits precisely 
corresponds to the class of adaptive Clifford circuits allowed in the original Gottesman-Knill 
theorem. 

This paper contains several results, summarized as follows: 

I. A Gottesman-Knill theorem for all finite Abelian groups (Theorem ITj) . Given 
any Abelian group G, every poly-size adaptive normalizer circuit over G, acting on 
any standard basis input, can be efficiently simulated by a classical computer. That 
is, we show that the conditional probability distribution arising at each measurement 
(given the outcomes of previous measurements) can be sampled efficiently classically. 

II. A stabilizer formalism for finite Abelian groups. Generalizing the well-known 
stabilizer formalism for qubits, we develop a stabilizer formalism for arbitrary Abelian 
groups. This framework is a key ingredient to efficiently track the evolution of quantum 
states under normalizer circuits. In particular, our results are: 
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— We provide an analytic formula, as well as an efficient algorithm, to compute the 
dimension of any stabilizer code over an Abelian group (Theorem [3]) . 

— We provide an analytic formula, as well as an efficient algorithm, to compute the 
update of any stabilizer group under Pauli measurements over arbitrary Abelian 
groups (Theorem [5]) . 

III. A normal form for stabilizer states (Theorem [8]) . We give an analytical formula 
to characterize the amplitudes of stabilizer states over Abelian groups and show how to 
compute these amplitudes efficiently. It follows that all stabilizer states over Abelian 
groups belong to the class of Computationally Tractable (CT) states, introduced in 
[la]. The interest of this property is that all CT states can be simulated classically in 
various contexts well beyond the setting of the present work — cf. [3l for a discussion. 

An important technical difference (and difficulty) compared to the original Gottesman-Knill 
theorem is that in the context of arbitrary finite Abelian groups (such as G = Z2") arith- 
metic is generally over large integers. This is in contrast to where arithmetic is simply 
over Z2 i.e. modulo 2. The difference is in fact twofold: 

• First, Z2 is a field. As a result, it is possible to describe the "standard" stabilizer formal- 
ism for qubits with vector space techniques over Z2. In this context methods like Gaussian 
elimination have straightforward analogues, which can be exploited in the design of classi- 
cal algorithms. The field property is, however, no longer present in the context of general 
Abelian groups. This complicates both the analytical theory and algorithmic aspects due 
to, e.g., the presence of zero divisors. 

• Second, in Z2 arithmetic is with small numbers (namely Os and Is), whereas in general 
finite Abelian groups arithmetic is with large integers. This is e.g. the case with G = Z2". 
Of course, one must beware that a variety of computational problems over the integers may 
in the worst case be intractable: consider e.g. the factoring problem or computing discrete 
logarithms. One of the main challenges in our scenario is to show that the "integer arith- 
metic" used in our classical simulation algorithms can be carried out efficiently. For this 
purpose, a significant technical portion of our work is dedicated to solving systems of linear 
equations modulo a finite Abelian group, defined as follows: given a pair of finite Abelian 
groups Ggoi and G (both of which are given as a direct product of cyclic groups), and a 
homomorphism A between them, we look at systems of the form A{x) = b where x G Gsoi 
and b £ G. We present polynomial-time deterministic classical algorithms for counting and 
finding solutions of these systems. These efficient algorithms lie at the core of our classical 
simulations of normalizer circuits. 

Finally we remark that, beyond the scope of classical simulations, the mathematical 
tools we develop could also have unexplored applications for quantum error correction viz. 
quantum stabilizer codes over general finite Abelian groups. 

Relation to previous work. 

In [l[ it was proven that one can sample classically efficiently the output distribution of 
any non- adaptive normalizer circuit followed by a terminal measurement in the standard 
basis. Our work extends on this result in various ways, as outlined above in I-II-III. Main 
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differences are the fact that here we consider adaptive normahzer circuits, and two different 
types of simulations: sampHng output distributions and computation of amphtudes. 

Restricting to groups of the form G = where d is constant, our work recovers previous 
results regarding classical simulations of Clifford circuits for qudits. Previous to our work, the 
case when d is a prime number was well-understood: if d = 2, the ability to sample classically 
efficiently follows from the Gottesman-Knill theorem [3, y|, whereas the computation of 
amplitudes from 17|; for prime values of d larger than 2, techniques given in 10(] yield 
efficient sampling simulations of adaptive Clifford circuits. Last, in the case when d is an 
arbitrary constant, some investigations have led to efficient simulations of Clifford circuits: 
ffist, techniques given in ll| can be used to simulate non-adaptive Clifford circuits followed 
by a terminal standard basis measurement (sampling or computation of relative phases); 
second, ref. extended the last sampling result to simulate terminal Pauli measurements 
and, in addition, a subclass of adaptive Clifford operations: the latter can be transformed 
into equivalent non-adaptive circuits using the principle of deferred measurement. To the 
best of our knowledge, however, our study seems to be the first that has provided efficient 
classical simulations of arbitrary adaptive Clifford circuits for qudits when d is an arbitrary 
constant integer. 

Finally, our work also connects to previous studies on the simulatibility of Abelian 
quantum Fourier transforms (QFTs), such as 3"21|. The relation between normalizer 



circuits to those works was discussed in [l] and we refer to this source. 



2 Preliminaries on finite Abelian groups 

This section is reserved for the main group-theoretical notions used in this work. Let 
Zrf = {0, 1, . . . , d — 1} be the additive group of integers modulo d. Then 

G = Zd,x...xZd^ (1) 

denotes a finite Abelian group, the elements of which are m-tuples of the form g = {g{l), 
. . . ,g(m)) with g{i) E Z^^-. Addition of two group elements is component-wise modulo dj. 
Every finite Abelian group can be expressed as a product of the type ([I]) via isomorphism, yet 
computing this decomposition is regarded as a hard computational problem ; throughout 
this paper, a product decomposition ([1]) of G is always explicitly given. The cardinality of 
G is denoted by g, and fulfills g = did2 ■ ■ ■ d^- For every i ranging from 1 to m, Cj G G 
denotes the group element which has 1 E Z^. in its i-th. component and zeroes elsewhere, 
where in slot k represents the neutral element in Z^^.. Remark that g = ^ g{i)Gi for every 
5 G G so that the m elements generate G. 



2.1 Characters 

Let g £ G. The function Xg is defined as 

X,W = exp(2.if:«(f«J (2, 

for all g, h £ G. Every function Xg is a character of G, i.e., it is a homomorphism from G 
into the nonzero complex numbers C*. This means that 

Xg{h + h') = xgih)x{h') (3) 
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for every g,h,h' G G. Note further that Xg(^) = Xh{g) and Xg+h = XgXh- The set of ah 
characters of G forms a group, called the character group or dual group, which is isomorphic 
to G. 



2.2 Orthogonal subgroups 

The character functions Xg give rise to a set-theoretical duality, sometimes called orthog- 
onality of Abelian subgroups (although it differs from the usual orthogonality of vector 
spaces). Given a subgroup H of the finite Abelian group G, its orthogonal subgroup is 
defined as 

H^ = {geG: Xhig) = h for ah h e H} . (4) 
Note that H-^ is indeed a subgroup of G. The main properties of H-^ are summarized below. 

Lemma 1 (Orthogonal subgroup). Consider a finite Abelian group G as in and let 

H and K he two arbitrary subgroups. Then the following statements hold: 

(a) {H^)^ = H 

(b) \H^ = \G/H\=q/\H\ 

(c) H <ZK if and only if C 

(d) (HnK)^ = {H^, K^) 



Proof: (a-b) are well-known, see e.g. [13(]. (c) is proved straightforwardly by applying 
definitions. We prove (d). Since n -fC is contained in both H and K if follows that 
C {H n K)^ and K-^ C (i? n K)^. Therefore {H^, K^) Q {H n K)^. We show 
K^)^ Q H n K, which implies the reversed inclusion. This comes from the fact that 
g _L {H-^, K^) implies g _L and g _L K^, or equivalently, g ^ H and g £ K. H 

2.3 Quadratic functions 

A function B from G x G to the nonzero complex numbers is called bilinear if for every 
g,h,x G G one has 

B{g + h,x) = B{g,x)B{h,x) and B{x,g + h) = B{x,g)B{x,h). (5) 

A function from G to the nonzero complex numbers is called quadratic if there exists a 
bilinear function B such that for every g,h G G one has 

a9 + h)=a9nh)B{g,h). (6) 

Although it is not obvious from the above definition, the number (^{g) turns out to be a 
complex phase for every g € G and for every quadratic function. More precisely, one has 
^{g)"^^ = 1 for every S G (if. It is easily verified that the product of two quadratic functions 
is again a quadratic function. Also the complex conjugate of any quadratic function is again 
quadratic. Using these properties one can show that the set of quadratic functions forms an 
(Abelian) group. 

We give some examples of quadratic functions (see also ref. [ij). First we consider 
G = Z™. Letting ^ be an m x m matrix with entries in Z2 and letting a S Z^, the following 
functions are quadratic: 

U-.x^i-ir^^"^ and ^,:x^i^^^ (7) 
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where x G and a^x is computed over Z2 (i.e. modulo 2). Note that the exponent in 
is polynomial of degree 2 in x, whereas the exponent in has degree 1. To prove that these 
functions are quadratic in the sense used in this work, we note that 

Ux + y) = a(x)a(y)(-i)""(^+^")^ (8) 

U^ + y) = e(:z^K(y)(-l)^^"'^^ ^ithq{x,y) = {Jx){Jy) (9) 

Identity Q can be proved by distinguishing between the 4 cases a^x,a^y € {0,1}. The 
above identities can be used to show that and are quadratic. 

Considering a single cyclic group G = Z^, examples of quadratic functions are 

^^^b^Hcz and z ^7''^(^+'^); u := e'^^'^'^ , := uj^^^ . (10) 
We refer to fl*] for a proof. 

2.4 Homo-, iso- and auto- morphisms 

Given two finite Abelian groups H and G, a group homomorphism from to G is a map 
A : H ^ G that fulfills A{g + h) = A{g) + A{h) for every g,h e H (in other words, 
A is linear). An isomorphism from i7 to G is an invertible group homomorphism. An 
automorphism of G is an isomorphism of the form a : G ^ G, i.e. from the group onto 
itself. The set of all automorphisms of G forms a group, called the automorphism group. 

Throughout this work, group homomorphisms between Abelian groups are to be de- 
scribed in terms of matrix representations, which are defined as follows: 

Definition 1 (Matrix representation). Given a homomorphism A : H ^ G between 
groups H = x • • • x Zc,^ and G = x • • • x , an m x n integer matrix A is said to 
be a matrix representation of A if its columns ai are elements of G, and if it holds that 

A{h)=Ah (modG), for every /i G i?. (11) 

Conversely, anmxn integer matrix A is said to define a group homomorphism from H to G 
if its columns Oj are elements of G and the operation Ah (mod G) is a group homomorphism. 

In (jlip we introduced some conventions, that we will use: first, the element h is seen 
as a column of integer numbers onto which A acts via matrix multiplication; second, (mod 
G) indicates that multiplications and sums involved in the calculation of Ah are performed 
within G, taking remainders when necessary. 

The main properties of matrix representations are now summarized. 

Proposition 1. Every group homomorphism A : H ^ G has a matrix representation. 
Moreover, an m x n matrix A with columns ai € G defines a homomorphism iff its columns 
fulfill the equations 

Citti = (mod G), for every i. (12) 

Proof: First, given A, we show that A := [^(ei), . . . , ^(e^)], where Cj := (0, . . . , Ij, . . . , 0), 
is a matrix representation. Since every h G H decomposes as h = Y^ h{i)ei, it follows, using 
linearity of A., that 

A{h)= A{^h{i)e^^ =^h{i)A{ei) = Ah (mod G). (13) 
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The right imphcation of the iff comes readily from 

CiUi = aAei = A{ciei) = ^(0) = (mod G) (14) 

For the converse, we let A act on g, h and g + h without taking remainders; we obtain 

Ag + Ah = Y}9{i) + Hi)]ai, A{g + h) = ^{g + h){i)ai. (15) 

Recalling associativity of H and G, the latter expression shows that Ah defines a function 
from H to Z™, and, thus. Ah (mod G) is a function from H to G. Last, it holds for every 
i that g{i) + h{i) = qiCi + {g + h){i) for some integers qi , since (by definition of the group 
H) [g + h){i) is the remainder obtained when g{i) + h{i) is divided by Cj {qi would be the 
quotient). It follows, subtracting modularly, that A{g) + A{h) — A(g + h) = "^qiCiUi = 
(mod G) for every g, h; and, due to, A defines a linear map. ■ 

2.5 Computational group theory 

Computational aspects of finite Abelian groups are now discussed; our discourse focuses on 
a selected catalog of computational problems relevant to this work and efficient classical al- 
gorithms to solve them. Since this section concerns only classical computational complexity, 
we will tend to omit the epithet classical all the way throughout it. 

To start with, we introduce some basic notions of computer arithmetic. From now on, 
the size of an integer is the number of bits in its binary expansion. Remark that every group 
([1]) satisfies the inequalities 2*" < g and di < q, for every i. It follows thence readily that 
m is O(polylogg), and that one needs at most a polylog(£|) amount of memory to store an 
element g € G {in terms of bits). 

We discuss now how to perform some basic operations efficiently within any finite Abelian 
group ([T|). First, given two integers a and b of size at most /, common arithmetic operations 
can be computed in poly(/) time with elementary algorithms: such as their sum, product, 
the quotient of a divided by b, and the remainder a mod b Therefore, given g,h £ G, 
the sum g + h can be obtained in polylog(0) time by computing the m remainders g{i) + 
h{i) mod di. Similarly, given an integer n, the element ng can be obtained in polylog(3,n) 
time by computing the remainders ng{i) mod di. 

In connection with the previous section, it follows from the former properties that matrix 
representations can be stored using only a polynomial amount of memory, and, moreover, 
that given the matrix representation A we can efficiently compute Ah (mod G). Specifically, 
given a matrix representation A of the homomorphism A : H ^ G,we need polylog(|-ff|, |G|) 
space to store its columns Oj as tuples of integers, and polylog(|-fr|, IGj) time to compute 
the function A{h). 

Periodically, and at crucial stages of this investigation, some more advanced algebraic 
computational problems are bound to arise. The following lemma compiles a list of group 
theoretical problems that will be relevant to us and can be solved efficiently by classical 
computers. 

Lemma 2 (Algorithms for finite Abelian groups). Given H, K, two subgroups of 
G, and {hi}, {kj}, polynomial- size generating- sets of them, there exist efficient classical 
algorithms to solve the following problems deterministically. 

(a) Decide whether b £ G belongs to H; if so, find integers Wi such that b = Y^Wihi. 
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(b) Count the number of elements of H . 

(c) Find a generating- set of the intersection H K. 

(d) Find a generating-set of . 

(e) Given the equations Xhiid) = 7*^'; /i^^^ elements {go,gi, ■ ■ ■ ,9s) such that all solutions 
of the system can be written as linear combinations of the form go + • 

The proof of the lemma is divided in two parts which are fully detailed i.o. in appendices 
El and [HI The rest of this section describes the high-level structure of the proof. 
In short, appendix |A] contains a proof of the following statement. 

Lemma 3. Problems (a-e) in lemma \M are polynomial-time reducible to either counting 
or finding solutions of systems of equations of the form A{x) = b; where A is a group 
homomorphism between two (canonically- decomposed) finite Abelian groups, Ggoi o,nd G, to 
which X, b respectively belong; given that a matrix representation of A is provided. 

Mind that, since ^ is a linear map, the set Xgoi of solutions of such a system is either 
empty or a coset with the structure 



By finding solutions we refer to the action of finding one particular solution xq of the system 
and a (polynomially-large) generating set of ker A. 

To provide an example, we prove now lemma [3] for the problems (d-e) in lemma [21 for 
the rest of cases, we refer to the appendices. 

Example: (d,e)th cases of lemma [2]. 

First of all, remark that problem (d) reduces to (e) by setting all Oj to be — this yields the 
system ([3]), whose solutions are the elements of the orthogonal subgroup. Thence, it will be 
enough to prove the (e)th case. Moreover, since the equations XhXg) = 7"' can be fulfilled 
for some g € G only if all 7"' are gth-roots of the unit, this systems can only have solutions 
if all ai are even numbers. As we can determine it efficiently whether these numbers are 
even, we assume from now on that it is the case. 

Now define a tuple of integers b coefficient-wise as b{i) := aj/2; use the later to re- 
write 7°' = exp (2Tii &(i)/0). Also, denote by H the group generated by the elements hi. 
By letting g multiply numerators and denominators of all fractions in ([2]), the system of 
complex exponentials Xhi (g) = 7"' can be turned into an equivalent system of congruences 
^j (g/dj) hi{j)g{j) = b(i) mod g. Finally, by defining a matrix J7 with coefficients j) := 
is/dj) hi{j) the system can be written as 



where b belongs to G = Zg, being r the number of generators hi, and we look for solutions 
inside Ggoi = G. Moreover, the coefficients of Q fulfill djQ{i,j) = mod g; hence, condition 
()12p is met and defines a homomorphism. 

Finally, il. can be computed in O(polylogg) using aforementioned algorithms to multiply 
and divide integers. It is now routine to check, using the concepts developed thus far, that 
both log|Gsod ^iid log|G| are O(polylogg); as a result, the inputsize of the new problem, 
as well as the memory needed to store and b, are all O(polylogg). 



Xsoi = xo + ker A. 



(16) 



ng = b (mod G) 



(17) 
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A remark Note that the group homomorphism io{g) := ^{g) (mod Zg) fulfills kercj = H-^. 
Therefore, if we substitute H with H' := in the procedure above, given s = polylog(0) 
generators of H' , we would obtain an s x m integer matrix 0' that defines a second group 
homomorphism : G — )• such that 

w{g) = Q.'{g) (modG) and = H'^ = H. (18) 

As a result, our algorithm to compute generators of leads also to an efficient method 
to construct, given any subgroup H G, a homomorphism w whose kernel is H. This fact 
will be used later in the text, in section [71 ■ 

The final ingredient to complete the proof of lemma [2] is the following theorem. 

Theorem 1 (Systems of linear equations over finite Abelian groups). Given any 
element b of the group G = x • • • x and any mx n matrix A which defines a group 
homomorphism from H = x • • • x to G, consider the system of equations Ax = b 
(mod G) . Then, there exist classical algorithms to solve the following list of problems in 
polylog(|i7|, |G|) time. 

1. Decide whether the system admits a solution. 

2. Count the number of different solutions of the system. 

3. Find Xo,xi, . . . ,Xr G H such that all solutions of the system are linear combinations 
of the form xq + ^ hxi. 

The main ideas underlying the proof of theorem [1] are as follows: first, we show how to 
reduce Ah = b (mod G) in polynomial-time to an equivalent system of linear congruences 
modulo d, where d is suitably upper-bounded; second, we apply fast algorithms to compute 



Smith normal forms to tackle the latter problem 2j]. For details, we refer to appendix 



3 Pauli and Clifford operators and normalizer circuits over 
Abelian groups 

Here we extend the notion of Pauli and Clifford operators for qubits [1] and qudits J25I . [lo| 
to all finite Abelian groups. Throughout this section we follow the definitions of Let 
G be a finite Abelian group as in ([!]). Then G is naturally associated to a g-dimensional 
Hilbert space = ■ ■ ■ C^'" with a basis B labeled by group elements 

\g) = \gil)) ■ ■ ■ (E> \gim)) for all g£G. (19) 

This basis is henceforth called the standard basis. Introduce the following operators acting 
on C^: 

X{g) := ^ \h + g){hl Z{g) := Xg{h)\h){h\, (20) 

heG heG 

where g £ G. Since X(g) acts as a permutation on the standard basis, this operator is 
unitary. Since |Xg(/i)| = 1, the operator Z{g) is unitary as well. With these definitions, a 
Pauli operator over G (hereafter often simply denoted Pauli operator) is a unitary operator 
of the form 

a{a,g,h):=j''Z{g)X{h), (21) 
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where 7 := e"/^ is a primitive root of unity and a G Z2g. The triple {a,g,h) describing the 
Pauli operator is caUed the label of a. It is important to remark that the label constitutes 
an efficient description of a comprising log(0) bits. Owing to, from now on we will specify 
Pauli operators in terms of their labels; the latter will represent the standard encoding of 
these operators. 

Note that every Pauli operator factorizes as a tensor product relative to the tensor 
decomposition of C*^ i.e. a can be written as a = f/i • • • Cg) Um where Ui acts on C^' . This 
property can be verified straightforwardly by applying ([20]) and the definition ([2]) of the 
characters of G. 

Basic manipulations of Pauli operators can be carried out transparently by translating 
them into transformations of their labels: we review now some of these rules. First, the 
Pauli matrices (|20p obey the following commutation rules: 

X{g)X{h) = X{g + h)= X{h)X{g) 

Z{g)Z{h) = Z{g + h) = Z{h)Z{g) (22) 
Z{g)X{h) = Xg{h)X{h)Z{g). 

Combinations of these rules straightforwardly lead to the next two propositions. 

Proposition 2 (Products and powers of Pauli operators Consider Pauli oper- 

ators a and r and a positive integer n. Then ar, a"' and are also Pauli operators, the 
labels of which can be computed in polylog(g,n) time on input of n and the labels of a and 
r. Moreover, = a"^^'^. 

Proposition 3 (Commutativity). Consider two Pauli operators a{ai, gi,hi) = g\ and 
'^{0'2, 92,1^2) = o"2- Then the following statements are equivalent: 

(i) 0"! and (T2 commute; 

(ii) Xgi{h2) = Xgzihi); 

(Hi) X := {gi,hi) and y := {h2,—g2) cire orthogonal elements of G x G i.e. Xxiu) = 1- 

Proposition [2] implies that the set of all Pauli operators over G forms a (finite) group, 
called the Pauli group (over G). 

A unitary operator U on C*^ is called a Clifford operator (over G) if U maps the Pauli 
group V'^ onto itself under the conjugation map a — t- UaUl It is easy to see that the set of 
all Clifford operators forms a group, called the Clifford group C^. Formally speaking, the 
Clifford group is the normalizer of the Pauli group in the full unitary group acting on 
Next we define three basic classes of unitary operators on which are known to belong to 
the Clifford group [1]. 

I. Quantum Fourier transforms. The quantum Fourier transform (QFT) over is 
the following unitary operator on C^': 

Fi = ^= y'a;f^|x)(?/|; = exp(2Tii/di) (23) 

where the sum is over all x,y G Z^^. . The QFT over the entire group G is given by 
F = Fi ^ ■ ■ ■ Fm, which acts on the entire space C*^. Any operator obtained by 
replacing a subset of operators Fi in this tensor product by identity operators is called 
a partial QFT. 
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II. Automorphism gates. Given an automorphism a of G, the associated automor- 
phism gate \Joc maps \g) — )■ 

III. Quadratic phase gates. Given a quadratic function ^ on G, the quadratic phase 
gate is the diagonal operator mapping \g) — )• ^(g)!^). Since ^{g) is a complex phase 
for every g ^ G, every quadratic phase gate is a (diagonal) unitary operator. 

A unitary operator which is either a (partial) quantum Fourier transform or its inverse, 
an automorphism gate or a quadratic phase gate is generally referred to as a normalizer gate. 
A quantum circuit composed entirely of normalizer gates is called a normalizer circuit over 
G. The size of a normalizer circuit is the number of normalizer gates of which it consists. 

In this paper we will be interested in classical simulations of normalizer circuits. To 
make meaningful statements about classical simulations one has to specify which classical 
descriptions of normalizer circuits are considered to be available. This is discussed next. 
First, a partial quantum Fourier transform is described by the set of systems C^. on which it 
acts nontrivially. Second, an automorphism gate is described by the matrix representation 
of the associated automorphism. Third, let be an arbitrary quadratic function. Since 
^{9)^^ = L there exists n(g) G such that ^(5) = e^^'^^9)/s for every g G G. It was 
shown in [l| that the 0{m?) integers n{e^) and n(e* + e^) comprise an efficient description 
of ^ and, thus, of the associated quadratic phase gate. Henceforth we will assume that all 
normalizer gates are specified in terms of the descriptions given above, which will be called 
their standard encodings. Each standard encoding comprises polylog(0) bits. 

It is known that every normalizer gate belongs to the Clifford group: 



Theorem 2 (Normalizer gates are CliflFord Every normalizer gate is a Clifford 

operator. Furthermore let U he a normalizer gate specified in terms of its standard classical 
encoding as above, and let a he a Pauli operator specified in terms of its label. Then the 
label of U aU'^ can be computed in polylog(0) time. 

For any group of the form G = Z™, the entire Clifford group is known to be generated (up 



to global phase factors) by normalizer gates Uj] (see also section [4]) . More strongly, every 



Clifford group element can be written as a product of at most polylog(0) such operators. 
We conjecture that this feature holds true for Clifford operators over arbitrary G: 

Conjecture 1. Let G be an arbitrary finite Abelian group. Up to a global phase, every 
Clifford operator over G can be written as a product of polylog(0) normalizer gates. 

Finally we point out that both automorphism gates and quadratic phase gates have a 
distinguished role within the Clifford group, characterized as follows: 

Proposition 4. Up to a global phase, every Clifford operator which acts on the standard 
basis as a permutation has the form X{g)Ua for some g €z G and some automorphism gate 
Ua- Every diagonal Clifford operator is, up to a global phase, a quadratic phase gate. 

Proof: The first statement was proved in [l]. We prove the second statement. Let D = 
'^(,{g)\g){g\ be a diagonal unitary operator (so that \£,{g)\ = 1 for all g £ G) in the Clifford 
group. Without loss of generality we may set ^(0) = 1 which can always be ensured by 
choosing a suitable (irrelevant) overall phase. Then for every h & G, D sends X{h) to a 
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Pauli operator under conjugation. This implies that there exists a complex phase 7(/i) and 
group elements fi{h), f2{h) £ G such that 

DX{h)D^ = -fih)Xih{h))Z{hih)). (24) 

Since D is diagonal, it is easy to verify that we must have fi{h) = h for every h G G. Now 
consider an arbitrary g G G. Then 

DX{h)D^\g) = ^{g)^{g + h)\g + h); (25) 
j{h)X{h)Z{Mh))\g) = j{h)xg{f2{h))\g + h). (26) 

Condition (j24p implies that (j25p is identical to ()26p for every g,h £ G. Choosing g = and 
using that ^(0) = 1 and Xoix) = 1 for every x £ G it follows that j{h) = ^{h). We thus find 
that 

^{9 + h)=^{gnh)xg{f2{h)). (27) 

The function B{g, h) := ^{g + h)^{g)^{h) is manifestly linear in g, since B{g, h) = Xg{f2{h)). 
Furthermore by definition B is symmetric in g and h. Thus B is also linear in h. ■ 

4 Examples 

Here we give examples of Pauli and Clifford operations. We illustrate in particular how the 
definitions of the preceding section generalize existing notions of Pauli and Clifford operators 
for qubits and qudits. 

4.1 G = 

In this case the standard definition of m-qubit Pauli operators is recovered. To see this, 
first note that we have = (8) • • • CS) i.e. the Hilbert space is a system of m qubits. 
Let ax and denote the standard Pauli matrices and let g £ be an m-bit string. Then, 
applying definition ([2Ut) one finds that 

X{g) = a^J-^^ ® • • • ® , Z{g) = ® • • • C$ af ('"^ . (28) 

Here g £ is an m-bit string: i.e. g{i) £ {0, 1}. In short, X(g) is a tensor product 
of (Tx-matrices and identities, and Z{g) is a tensor product of Uz-matrices and identities. 
Therefore, every Pauli operator (j20p has the form a oc f/i (8) • • • (8) Um where each Ui is a 
single-qubit operator of the form cr^^cr^ for some u,v £ 7Li- This recovers the usual notion 
of a Pauli operator on m qubits 

It was shown in [l] that the CNOT gate and the CZ gate (acting between any two 
qubits), the Hadamard gate and the Phase gate S = diag(l,z) (acting on any single qubit) 
are examples of normalizer gates for G = Z™. Note that these gates are the standard 
building blocks of the well known class of Clifford circuits for qubits. In fact, the entire 
Clifford group for qubits is generated by this elementary gate set Q]- 

4.2 G = Z^" 

In this case the Hilbert space C*^ = (8) • • • <8 is a system of m d-level systems (qudits) 
and Pauli operators have the form cr oc C/i(8>- • -(^Um, where each Ui is a single-qudit operator 
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of the form X^Z^^ for some u,v G Z^. Here and are the usual generahzations of ax 
and az, respectively [25i. ilQ]. These operators act on a single d-level system as follows: 

Xrf = ^|x + l)(x| and Zrf = ^e2'^'^/'^|x)(x| (29) 

where the sums run over all x ^'L^. Examples of normalizer gates over are generaliza- 
tions of the CNOT, CZ, Hadamard and Phase gates to qudits, as follows: 

SUMrf = ^\x,x^y)(x,y\- (30) 
CZ, = u;, := e^-/'^ (31) 

Sd = Eef^'^k)(^l; Cd:=e-/'^. (33) 

Here x and y rum over all elements in Z^^. To show that SUMj^ is a normalizer gate, note 
that {x,y) — )• (x,x + y) is indeed an automorphism of Ijd x Zf^. The gates CZd and 5, 
are quadratic phase gates; see section 11 of ref.[l|. In addition, the "multiplication gate" 
^d,a = |ax)(x| is also a normalizer gate, for every a E Z^^ which is coprime to d. Indeed, 
for such a the map x — t- ax is known to be an automorphism of Z,. It is known that the 
entire Clifford group for qubits (for arbitrary d) is generated by the gates SUM^^, Fd-, Sd and 
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4.3 G = Za- 

One can also consider G to be a single cyclic group, such as G = Z2"i. In this case, C*^ is a 
2™'-dimensional Hilbert space with standard basis {|0), . . . , 12"* — 1)}. Comparing with the 
previous examples, the important difference with e.g. Zg^ is that the structure of Z2»" does 
not naturally induce a factorization of the Hilbert space into m single-qubit systems. As 
a consequence, normalizer gates over Z2'" act globally on Ti, in contrast with the previous 
examples. 

Examples of normalizer gates are now given by -F2m, 82^^^ and M2m^a, following the 
definitions of the previous example with d = 2'^. Note that F2™ is the "standard" QFT 
used in e.g Shor's algorithm and the phase estimation quantum algorithm. 



5 Abelian Stabilizer Formalism 

In this section we develop further the stabilizer formalism for finite Abelian groups as started 
in [ij. We provide new analytic and algorithmic tools to describe them and analyze their 
properties. Throughout this section we consider an arbitrary Abelian group of the form 
G = Zd, X ••• xZd,„. 

5.1 Stabilizer states and codes 

Let 5 be a subgroup of the Pauli group V^. Then S is said to be a stabilizer group (over 
G) if there exists a non-zero vector l'^) G C'"' which is invariant under all elements in S i.e. 
a\ip) = IV') for every a G 5. The linear subspace V := {\tp) : a\tp) = \ip) for all cr G 5} is 
called the stabilizer code associated with S. If V is one-dimensional, its unique element (up 
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to a multiplicative constant) is called the stabilizer state associated with S. In this work 
we will mainly be interested in stabilizer states. Occasionally, however, it will be useful to 
consider the general setting of stabilizer codes (cf. e.g. theorem [3]). 

Note that every stabilizer group S is Abelian. To see this, consider a state IV') 7^ 
which is invariant under the action of all elements in S and consider two arbitrary cr, r G 5. 
Then (j22p implies that there exists a complex phase a such that err = ara. It follows that 
IV') = o^T\^p) = aTa\^p) = a\^p), where we have used that alip) = \ip) = rj'i/'). We thus find 
that = alip) so that a = 1 (i.e. a and r commute). 

Conversely, not every Abelian subgroup of the Pauli group is a stabilizer group. A simple 
counterexample is the group {/, — /} where / is the identity operator acting on C^. 

The support of a stabilizer code V is the set of all g £ G for which \g) has a nonzero 
overlap with V i.e. there exists G V such that {g\tp) 7^ 0. The support of a stabilizer 
state |(/)) is simply the set of all g £ G for which {g\(j)) 7^ 0. 

5.2 Label groups 

Let 5 be a stabilizer group over G. The diagonal subgroup V is the subgroup of S formed 
by its diagonal operators i.e. it consists of all operators in S of the form 'y^Z{g). Second, 
we introduce two subgroups H and D of G called the label groups of S: 

M = {/i G G : there exists 7"Z(c/)X(/i) G 5}, (34) 
D = {5 G G : there exists -f"'Z{g) G P}, (35) 

Using ()22p it is straightforward to verify that B is indeed a subgroup of G. To prove that IH 
is a subgroup as well, one argues as follows. Let a be a Pauli operator with label (a, h). 
We call g the "Z-component" and h the "X-component" of a. Denote the X-component 
formally by v'(cr) := h. Then HI is the image of S under the map ip. The commutation 
relations (f22]) yield 

(/9(cjt) = (p{(T) + ^p{t) for all a, r G 5. (36) 
This implies that <p is a homomorphism from S to G. It follows that EI is a subgroup of G. 

Proposition 5 (Label groups). Let S be a stabilizer group and assume that the labels of 
k = polylog(g) generators of S are given as an input. Then the label groups of S have the 
following properties: 

(i) M C D-L; 

(a) Generating sets of H, D can be efficiently computed classically; 
(Hi) The labels of a generating set ofT> can be efficiently computed classically. 

Proof: Property (i) is a straightforward consequence of the commutation relations given in 
proposition [3] and the definition of orthogonal subgroup To show property (ii), recall 
that the map ip defined above is a homomorphism from 5 to G with HI = lm(ip). Suppose 
that S is generated by {ai, . . . , cjfc}- Then EI is generated by {p{ai), . . . , cr{ak)}. this yields 
an efficient method to compute generators of H. To prove the second statement of (ii) as 
well as (iii) requires more work. The argument is a direct generalization of the proof of 
lemma 9 in [T] and the reader is referred to this work. H 
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5.3 Certificates 

The main purpose of this section is to provide a criterion to verify when a stabihzer group 
gives rise to a one-dimensional stabihzer code i.e. a stabilizer state. This is accomplished in 
corollary [TJ To arrive at this statement we first analyze how the the dimension of a general 
stabilizer code is related the structure of its stabilizer group. 

Theorem 3 (Structure Test). Let S be a stabilizer group with stabilizer code V. Then 
there exists go & G such that 

(i) supp(V) =go + B^, {ii) dim(V) = (37) 

where M, B are the label subgroups of S. Furthermore, there exist efficient classical al- 
gorithms to compute a representative go of the support, a generating set of D"*" and the 
dimension dim(V). 

Before proving theorem[3l we note that combining property (ii) together with proposition 
\5li) immediately yield: 

Corollary 1 (Uniqueness Test). Let S be a stabilizer group with stabilizer code V. Then 
V is one- dimensional if and only ifM and D are dual orthogonal subgroups: H = B"*-. 

Theorem [3jii) also leads to an alternative formula for the dimension of a stabilizer code: 

Corollary 2. The dimension ofV equals q/\S\. 

Proof: Consider the map : 5 — t- G as in section 15.21 which is a group homomorphism 
with image H. Furthermore the kernel of ip is precisely the diagonal subgroup T> of G. 
Since |Im ip\ = |5|/|ker ip\ it follows that |EI| = Finally we claim that T> and B 

are isomorphic groups so that \T>\ = |B|. To prove this, consider the map 5 : P — )• B that 
sends a = "f'^Z{g) to 5{ct) = g. Using (j22p it follows that this map is a homomorphism; 
furthermore, it is a surjective one by definition of B, and thus vend = B. The kernel of 5 is 
the set of all cr G 5 having the form a = 7"/. But the only operator in S proportional to 
the identity is the identity itself, since otherwise S cannot have a common +1 eigenstate. 
This shows that the kernel of 5 is trivial, so that T> and B are isomorphic, as claimed. The 
resulting identity |M| = |5|/|B| together with |B^| = |G|/|B| (recall lemma [T]) and theorem 
[3Kii) proves the result. ■ 

The result in corollary [2] is well known for stabilizer codes over qubits 0, 3 (i.e. where 
G = so that = 2™) and qudits (where G = T2) (3, 

We now prove theorem [3] using techniques developed in [i^] where the properties of so-called 
M-spaces were studied. We briefly recall basic concepts and results. 

A unitary operator acting on C*^ is said to be monomial if it can be written as a product 
U = DP where D is diagonal and P is a permutation matrix. A subspace M. of is called 
an M-space if there exists a group of monomial unitary operators Q such that € 
iff U\ip) = \(p) for every U ^ Q. The group Q is called a stabilizer group of A^. If 7W is 
one-dimensional, its unique (up to a multiplicative factor) element \tfi) is called an M-state. 
The support of M. is deflned analogously to the support of a stabilizer code i.e. it is the set 
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of all g G G such that \g) has a nontrivial overlap with Ai. With this terminology, every 
stabilizer code is an instance of an M-space and every stabilizer state is an M-state. To see 
this, note that every Pauli operator a{a,g,h) is a monomial unitary operator. Indeed, a 
can be written as a product a = DP where D = ^"•Z{g) is diagonal and P = X{h) is a 
permutation matrix. 

We introduce some further terminology. Let Q be an arbitrary monomial stabilizer group. 
For every g £ G, let Gg be the subset of Q consisting of all U £ Q satisfying U\g) oc \g) i.e. 
U acts trivially on g, up to an overall phase. This subset is easily seen to be a subgroup of 
Q. Also, we define the orbit Og of g as: 

Og = {h:3U eg s.t. U\g) oc \h)} (38) 

In the following result the support of any M-space is characterized in terms of the orbits Og 
and the subgroups Qg. 

Theorem 4 (Support of M-space |27l |). Consider an M-space A4 with monomial stabi- 
lizer group Q. Then the following statements hold: 

(i) There exist orbits Og^^ . . . , Og^ such that d = dim(A^) and 

supp(A^) = 03, U-.-UOg^. (39) 

(a) Consider g £ G and an arbitrary set of generators {Vi, . . . ,Vr} of Qg. Then g G 
supp(M.) if and only ifVi\g) = \g) for every i. 

Using this result, we can now prove theorem [3l 

Proof: [of theorem [3] We apply theorem U] to the Pauli stabilizer group S. In this case, 
the group Sg and the orbit Og fulfill 

Og = g + m, Sg = V. (40) 

To demonstrate the first identity in (j^Oj) . we use ([20]) which implies a{a,x,y)\g) oc \g + y) 
for every a{a,x,y) £ S. To show the second identity, first note that D\g) oc l^f) for every 
diagonal operator D £ T>, showing that T> C Sg. Conversely, if a £ Sg has label {a,x,y) 
then a\g) oc \g + y)- Since a £ Sg the state \g) is an eigenvector of a; this can only be true 
if y = 0, showing that a £ T>. 

Using proposition^ we can efficiently compute the labels of a generating set {ai, . . . , ar} 
of Sg = V, where fjj = ^°''-Z{gi) for some aj £ TL^^ and gi £ G. Owing to theorem Hfii) , 
any g £ G belongs to the support of V if and only if (Ji\g) = \g) for every i = 1, . . . ,r. 
Equivalently, g satisfies 

l'''XgM = ^ forani = l,...,r. (41) 

This system of equations is of the type considered in section 12.51 (cf. lemma [3] and the 
example after it) and can, therefore, be transformed into an equivalent linear system over 
groups: g £ supp(V) Clg = b (mod Zp. The elements gi generate the label group B, and 
thus the homomorphism u defined by satisfies kerw = D"*". Since the system is linear, 
its solutions form a coset of the form supp(V) = go + ker a; = go + for some particular 
solution go. This shows statement (i). 

Further, we combine (i) with theorem Hl^i) to get a short proof of (ii): the equation 

supp(V) = Og, U • • • U = (51 + M) U • • • U (<7d + H) = go + ID)^ 
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implies, computing the cardinalities of the sets involved, that d|EI| = dim V|]HI| = 

Finally, the ability to compute go and to find generators of D-*- efficiently classically 
follows applying theorem [1] to a linear system described by a r x m matrix Q that defines a 
homomorphism from G to Z^, with r G O(polylogg). Furthermore, we can compute dimV 
directly using formula (ii) together with proposition [5] and the algorithms of lemma [21 ■ 

6 Pauli measurements in the stabilizer formalism 

6.1 Definition 

Associated with every Pauli operator a as in (I2ip we will consider a quantum measurement 
in the eigenbasis of a. Consider the spectral decomposition o" = ^ XPx where A are the 
distinct eigenvalues of a and P\ is the projector on the eigenspace associated with eigenvalue 
A. Given a state {tp) G C^, the measurement associated with a is now defined as follows: 
the possible outcomes of the measurement are labeled by the eigenvalues {A} where each A 
occurs with probability ||Px|^)|Pi furthermore, if the outcome A occurs, the state after the 
measurement equals to P\\ip) up to normalization. 

Consider a group G of the form (1), with associated physical system C*^ = (>Si- • 
We remark that a measurement of the i-th system C''' in the standard basis {\0) , . . . ,\di — l)} 
can be realized as a measurement of a suitable Pauli operator, for every i ranging from 1 to 
m. To keep notation simple, we demonstrate this statement for the special case G = Z™, 
yet the argument generalizes straightforwardly to arbitrary G. Denote by E G the group 
element which has 1 E in its i-th component and zeroes elsewhere. Then definition 
(f20]l implies that the Pauli operator Z{ei) acts as Za on the i-th qudit and as the identity 
elsewhere, where was defined in ()29p . Note that has d distinct eigenvalues, each having 
a rank-one eigenprojector with x E Z^. It follows straightforwardly that measurement 

of Z{ei) corresponds to measurement of the i-th qudit in the standard basis. 

6.2 Implementation 

It is easily verified that every Pauli operator a can be realized as a polynomial size (unitary) 
quantum circuit fll]. Therefore, measurement of a can be implemented efficiently on a quan- 
tum computer using standard phase estimation methods Here we provide an alternate 
method. In particular we show that every Pauli measurement can be implemented using 
only normalizer circuits and measurements in the standard basis. This property will be a 
useful ingredient in our proof of theorem [71 

Lemma 4 ([28]). For any dimension d and for integers j and k such that j, k E Z^, there 
exists a poly-size normalizer circuit C over the group that transforms Z{j)X{k) into a 
diagonal Pauli operator of the form j'^ Z (gcd{j , k)) . Furthermore, there are efficient classical 
algorithms to compute a description ofC. 

Corollary 3. Consider a Pauli operator a over an arbitrary finite Abelian group G. Then 
there exists a poly-size normalizer circuit C over G such that CaC^ = ^°'Z{g). Furthermore, 
there are efficient classical algorithms to compute a description ofC, 7'*, 'a', and g. 

Proof: To compute C note that every Pauli operator over G has the form cr oc C/i (8) ••• (8) Um 
where Ui is a Pauli operator over Z^. and apply lemma [H to each factor. The rest follows by 
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applying theorem [2] to compute the label of CaC^ and, in the case of 7", by using standard 
algorithms to compute complex exponentials [2^. ■ 

This result reduces the problem of measuring general Pauli operators to that of imple- 
menting measurements of Z{g). Indeed, given an arbitrary a to be measured, we can always 
compute a poly-size normalizer circuit that transforms it into a diagonal operator 'y"'Z{g), 
using corollary [3l Then, the measurement of a is equivalent to the procedure (a) apply C; 
(b) measure 'y°'Z{g); (c) apply C^. Finally, Pauli operators that are proportional to each 
other define the same quantum measurement, up to a simple relabeling of the outcomes. 
Therefore it suffices to focus on the problem of measuring an operator of the form Z(g). 

Note now that, by definition, the eigenvalues of Z(g) have the form Xg{h)- Define the 
following function uo from G to Z^, where d = lcm(di, . . . , dm)'- 

to{h) = ^ gi^Hi) mod d. (42) 

I 

With this definition one has Xg{h) = e^'^^^i^) I . Given any y G Z^j, the eigenspace of Z{g) 
belonging to the eigenvalue A = e^'^^y/'^ is spanned by all standard basis states \h) with 
uj{h) = y. 

Note that w is a group homomorphism from G to Z^ as it fulfills ()12p . As a result, the 
controlled operation f{h,a) = {h,a + uj{h)) is a group automorphism of G x Z^ and it can 
be implemented by a normalizer gate Uf\h, a) = \h,a + uj{h)). 

The gate Uf can now be used to measure Z{g), with a routine inspired by the coset-state 
preparation method used in the standard quantum algorithm to solve the Abelian hidden 



subgroup problem 13|, ll4|: first, add an auxiliary d-dimensional system in the state |0) 
to C*^, being the latter in some arbitrary state \'il>)] second, apply the global interaction Uf, 
third, measure the ancilla in the standard basis. The global evolution of the system along 
this process is 



heG heG \h:uj{h)=y 

The measurement yields an outcome y ^ with probability py = 'Ylh-uj(h)=y The 
latter precisely coincides with HP^IV')!!^ where P\ is the eigenprojector associated with the 
eigenvalue A = e^'^'^/'^ and, therefore, we have implemented the desired measurement. 

In figure [1] we show a poly-size quantum circuit that implements the measurement of 
the Pauli operator a = CZ{g)C^ in the way just described. In the picture, the m + 1 
horizontal lines represent the m physical subsystems that form C*^ = C^^ ■ ■ ■ C'^™ and 
the ancillary system C^; the numbers Cj := d/dig{i) are chosen to compute the function 
()42p in the ancillary system. For merely pictorial reasons, the depicted measurement acts 
on a standard-basis state. 

Two remarks. First, the state of the ancilla could be reset (with Pauli gates) to its origi- 
nal value once the measurement outcome (jj{x) is recorded; this could be used to implement 
a series of measurements using only one ancilla. Second, the value uj[x) can be used to 
compute A = Xgix) = e^'^^'^^^)/'^ 



Finally we mention that a procedure given in [181] to implement measurements of qudit 



Pauli operators (as presented in section IT2]) can be recovered from ours by choosing G = Z™. 
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Figure 1: Quantum circuit implementing measurement of operator a 



6.3 Measurement update rules 

In this section we show that Pauh measurements transform stabihzer states into new sta- 
biUzer states. We give an analytic formula to update their description. Moreover we show 
that the update can be carried out efficiently. 

Theorem 5. Consider a stabilizer state \(p) over G with stabilizer group S and let a be a 
Pauli operator. Perform a measurement of a on 10), let the measurement outcome he labeled 
by an eigenvalue A of a, and let \(j)m) denote the post-measurement state. Then the following 
statements hold: 



(i) The state \(j)m) is a, stabilizer state, with stabilizer group 

S^ = (\a,Cs{a)). (43) 

Here Cs{a) denotes the centralizer of a inside S, i.e. the group containing all elements 
of S that commute with a. 

(a) The labels of a generating set of Sm can be computed efficiently classically, given the 
labels of a generating set of S. 

Proof: First we show tliajt \(prn 

) is stabilized by Sm- To see this, first note that |</'?n) 
trivially stabilized by Act. Furthermore, a commutes with every r G Csicr). It follows that 
the projector P onto the A-eigenspace of a commutes with r as well (this can easily be 
shown by considering a and r in their joint eigenbasis). Hence tP|0) = -Pt|0) = -P|0). 
Using that {(pm) oc P\4>), we find that rlcprn) = |0m) for every r G Cs{a). 

Second, we prove that \(j)m) is the unique state stabilized by the group Sm- Without loss 
of generality we restrict to the case a = Z{gm)- This is sufficient since, first, every Pauli 
operator can be transformed into an operator of the form aZ{g) with a suitable normalizer 
circuit C (cf. the discussion in section [6^2]) : and, second, for any normalizer circuit C, the 
quantum state \(f) 77^) is a stabilizer state with stabilizer group Sm if and only if C\^m!) is a 
stabilizer state with stabilizer group CSmC^ ■ 

Working with the assumption a = Z{g 77^), we write the label subgroups '^m and ^m 
of Sm in terms of the label groups EI and B of S. We have Sm = (Act, Cs{a)) where 
a = Z{gm) for some gm G G. This implies that only the labels of Cs{(y) contribute to M.m- 
The centralizer Cs{(y) can be written as Cs{(y) = 5 R C-p{a), where C-pi^a) is the subgroup 
of all Pauli operators that commute with a. Thence, using proposition [3] we see that Cp{a) 
consists of all 'y°'Z{g)X{h) with labels h G {gm)'^- Hence, 

Mm = Mn{gm)^ (44) 
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Due to the commutativity of Z{gm) and Cs{(y)i any element in can be reordered as 
T Z{gmY, with r G Csic)- Therefore, the diagonal group of Sm can be written as Vm = 
(P', Z{gm)) where V is the diagonal subgroup of Cs{a). We now claim that V = V where 
T) is the diagonal subgroup of S. To see this, first note that trivially D' <Z D since Csio') 
is a subgroup of S. Conversely, D <^ T>': as every diagonal element of S commutes with 
Z{gm), we have V C Cs{a); but this implies V C V'. 

Putting everything together, we thus find = {V, Z{gm)). It follows: 

D„ = (D,(5„)) =^ Oi = {D,{gm))^ = D^n{gm)^, (45) 

where we used proposition [TJ Since S uniquely stabilizes |(/)), we have HI = D"*- owing to 
corollary [TJ With (j45p and (j44p this implies that = B^. Again using corollary [H it 
follows that 5m uniquely stabilizes 

To complete the proof of the theorem, we give an efficient classical algorithm to find 
a generating set of the centralizer Cs{cr); our approach is to reduce this task to a certain 
problem over the group G x G that can be efficiently solved using lemma [21 In first place, 
we define K C G x G to he the group of tuples {g, h) such that there exists a stabilizer 
operator a{a,g,h) £ Gs{a). Then we prove that Cs{a) is isomorphic to K via the map 
K : cj(a, g, h) — )• {g, h), and that k, is efficiently classically invertible: this reduces the problem 
to finding a generating set of K and applying the map k,~^ to all its elements. 

First, it is straightforward to verify that n is an isomorphism. Equations ()22|) imply 
that the map is indeed linear. Surjectivity is granted by definition. Invertibility follows 
then from the fact that only elements of the type 7'*/ S Gs{cr), for some a, belong to ker k 
(where I denotes the identity): the latter are invalid stabilizer operators unless 7" = 1. 

Second, we show how to compute k~^. Let the operator to measure a be of the (general) 
form a = 7"'"Z(x)X(?/), and let {a',g',h') be the label of an arbitrary stabilizer t £ S. 
Given a set of (mutually commuting) generators di, . . . , cr,. of S, with corresponding labels 
{ai,gi, hi), the element r can be written in terms of them as 

r = n = 7"'^ (E ^^^di) Z [Yl (46) 

for some integers fj. From this equation it follows that K C {{gi, hi), . . . , {g^, hj.)), which 
leads us to the following algorithm to compute k^^: given {g, h) G K, use algorithm lemma 
[Ula) to compute r integers Wi such that {g,h) = Y^'Wi{gi, hi); due to ([22]) . the stabilizer 
operator defined as = J| cjJ"* (whose label can be efficiently computed) is proportional to 
X{g)Z{h); it follows that k{<;) = {g,h) and, hence, <; equals K^^{g,h). 
Finally, combining (j46p with formula (iii) in proposition [3] we obtain 

K = {y, -x)^ n {{gi,hi), {gr, K)). (47) 

Using eq. (I47p together with algorithms (c-d) of lemma [2 we can efficiently compute s = 
polylog(0) elements (xi,?/i), . . . , {xs,ys) that generate K; applying to these, we end up 
with a set of stabilizer operators K~^{xi,yi) that generates 6*5(0"). ■ 

7 Gottesman-Knill theorem for arbitrary finite Abelian groups 

Recall that in [1] the following classical simulation result was shown: 
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Theorem 6. Let G = x • • • x be a finite Abelian group. Consider a polynomial 
size unitary normalizer circuit over G acting on a standard basis input state. Both circuit 
and input are specified in terms of their standard encodings as described above. The circuit 
is followed by a measurement in the standard basis. Then there exists an efficient classical 
algorithm to sample the corresponding output distribution. 

In the theorem, the standard encoding of a normahzer circuit is defined as is in section 
[3] in this work; the standard encoding of a standard basis input state \g) is simply the tuple 
g, i.e. a collection of m integers. 

The main classical simulation result of this paper (theorem [7] below) is a generalization 
of the above result. Rather than unitary normalizer circuits, the family of quantum circuits 
considered here is that of the adaptive normalizer circuits. A polynomial-size adaptive 
normalizer circuit consists of polylog(g) elementary steps, each of which is either a unitary 
normalizer gate U or a Pauli measurement M. Furthermore, the choice of which U or M to 
apply in any given step may depend, in a polynomial-time computable way, on the collection 
of outcomes obtained in all previous measurements. The notion of adaptive normalizer 
circuits is thus a direct generalization of the adaptive Clifford circuits considered in the 
original Gottesman-Knill theorem [3, Si- Note that, compared to theorem [6l two elements 
are added. First, measurements are no longer restricted to be standard basis measurements 
but arbitrary Pauli measurements. Second, the circuits are adaptive. 

Before stating our classical simulation result, we make precise what is meant by an 
efficient classical simulation of an adaptive normalizer circuit. First, recall that the outcomes 
of any Pauli measurement are labeled by the eigenvalues of the associated Pauli operator. 
Since cr^s = / (recall proposition [2]) it follows that each Pauli operator eigenvalue is a 20-th 
root of unity i.e. it has the form A = e'^''^'^^ for some k £ {0, . . . ,2q — 1}. This implies that 
any Pauli measurement gives rise to a probability distribution over the set of 2g-th roots of 
unity; we denote the latter set by 82^. Now consider an adaptive normalizer circuit C. Let 
Pj(A|Ai • • • Aj_i) denote the conditional probability of obtaining the outcome A S 82^ in the 
i-th measurement, given that in previous measurements the outcomes Ai • • • Aj_i G 82^ were 
measured. We now say that C can be simulated efficiently classically if for every i the i-th 
conditional probability distribution Pj(A|Ai • • • Aj_i) can be sampled efficiently on a classical 
computer, given the description of all gates and measurement operators in the circuit. 

Theorem 7 (Classical simulation of adaptive normalizer circuits). Consider a 
polynomial- size adaptive normalizer circuit over G, specified in terms of its standard en- 
coding, which acts of an arbitrary standard basis input state. Then any such circuit can be 
efficiently simulated classically. 

Proof: Let C denote the adaptive normalizer circuit. Without loss of generality we assume 
that the input state is |0). Indeed, any standard basis state \g) can be written as \g) = 
X{g)\0); the Pauli operator X{g) can be realized as a polynomial-size normalizer circuit [l| 
and can thus be absorbed on the overall adaptive normalizer circuit. Letting Ci G G denote 
the i-th. "canonical basis vector" , the state 1 0) is a stabilizer state with stabilizer generators 
Z(ei), . . . , Z{em) pj]- We now recall the following facts, proved above: 

(a) Given any normalizer gate U and any stabilizer state \tp) specified in terms of a gener- 
ating set of polylog(0) generators, the state U\ip) is again a stabilizer state; moreover 
a set of generators can be determined efficiently (cf. theorem [2]) . 
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(b) Given any Pauli operator a and any stabilizer state specified in terms of a gen- 
erating set of polylog(0) generators, the state {ipx) obtained after measurement of a, 
for any outcome A, is again a stabilizer state; moreover a set of generators can be 
determined efficiently (cf. theorem [5]). 

Furthermore, the measurement probability distribution can be sampled efficiently in 
polynomial time on a classical computer. The latter is argued as follows. First, it 
follows from the discussion in section [6^2] that the simulation of any Pauli measurement, 
on some input stabilizer state \ip), reduces to simulating a unitary normalizer circuit 
(the description of which can be computed efficiently) followed by a standard basis 
measurements (acting on the same input {ip) and a suitable ancillary stabilizer state 
|0)). Second, normalizer circuits acting on stabilizer state inputs and followed by 
standard basis measurements on stabilizer states can be simulated efficiently: this was 
proved for the special case of coset state inputs in (H; their argument, however, carries 
over immediately to the general case of stabilizer state inputs. 

The proof of the result is now straightforward. Given any tuple Ai, . . . , Aj-i, a generating set 
of stabilizers can be computed efficiently for the state of the quantum register obtained im- 
mediately before the i-th measurement, given that the previous measurement outcomes were 
Ai • • • Aj-i. Furthermore, given this stabilizer description, the distribution Pj(A|Ai • • • Ai_i) 
can be sampled efficiently on a classical computer, as argued in (b). ■ 

To conclude this section we comment on an interesting difference between normalizer 
circuits and the "standard" qubit Clifford circuits, concerning the role of adaptiveness as a 
tool for state preparation. For qubits, adaptiveness adds no new state preparation power 
to the unitary Clifford operations. Indeed for any n-qubit stabilizer state \^) there exists a 
(poly-size) unitary Clifford circuit C such that = 7CIO)", for some global phase 7 {l7|- In 
contrast, over general Abelian groups G this feature is no longer true. The associated adap- 
tive normalizer circuits allow to prepare a strictly larger class of stabilizer states compared 
to unitary normalizer circuits alone. 

To demonstrate this claim, we provide a simple example of a stabilizer state over G = Z4 
that cannot be prepared from standard basis input states via unitary normalizer transforma- 
tions over G, even in exponential time. However, the same state can be prepared efficiently 
deterministically if one considers adaptive normalizer schemes. We consider 

|V') = -^(|0) + |2)) (48) 

Suppose that there existed a unitary Clifford operator U G C'-' which generates from 
|0). Since the stabilizer group of |0) is generated by Zd, the stabilizer group of \ip) would be 
generated by UZ^U^ . However it was shown in [111] that the stabilizer group of \Tp) cannot 
be generated by one single Pauli operator (i.e. at least two generators are needed), thus 
leading to a contradiction. 

On the other hand, we now provide an efficient adaptive normalizer scheme to prepare, 
not only the example I'i/'), but in fact any coset state 13- iB] of any finite Abelian group G. 
This refers to any state of the form 



H + x) := \h + x), (49) 
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where H is a subgroup of G and x £ G. Note that \^) is a coset state of the group G = Z4 
with H := (2) and x := 0. 

Our algorithm to efficiently prepare general coset states \H + x) receives the element x 
and a polynomial number of generators of H. In section [231 (in the example after lemma [3]) 
we showed how to efficiently compute the matrix representation of a group homomorphism 

: G — >• such that kertz; = H, where the integer s is O(polylogg) and d = q. Given 
w, we define a group automorphism a of the group G x by a{g, h) := {g, h + w{g)). We 
now consider the following procedural 

|0)|0) ^ ^ E l^)l^(^)) ^ ^ E \9 + m = \g + H)\h), (50) 

where F denotes the QFT over G, the unitary Ua is the automorphism gate sending \g,h) 
to \a{g, h)), and M is a measurement of the second register in the standard basis. If the 
measurement outcome is b, then the post-measurement state is \g + H)\b) where g is a 
solution of the equation Tu(g) = b. It can be verified that each coset state of H (and thus 
also the desired coset state \x + H)) occurs equally likely, i.e. with probability p = \H\/\G\: 
in general, p can be exponentially small. However, if we apply adaptive operations, we 
can always prepare \x + H) with probability 1, as follows. First, given the measurement 
outcome b we efficiently compute an element g' £ G satisfying Tu(g') = b using theorem [H 
Then we apply a "correcting" Pauli operator X{x — g') to the first register state, yielding 
X{x — g')\g + H) = \x + [g — g') + H) = \x + H) as desired (we implicitly used g — g' £ H). 



8 Normal form of stabilizer states 

In this section we give an analytic characterization of the amplitudes of arbitrary stabi- 
lizer states over finite Abelian groups. In addition, we show that these amplitudes can be 
efficiently classically computed. 

Theorem 8 (Normal form of an stabilizer state). Every stabilizer state \cj)) over a 
finite Abelian group G with stabilizer group S has the form 

|</>) = a^ j;C(/i)|s + /i). (51) 

V PI hm 

Here a is a global phase, EI is the label group (3^ , s £ G, and relative phases are described 
by a quadratic function on the group M. Furthermore, if a generating set {ai, . . . ,0"^} of 
S is specified, the following tasks can be carried out efficiently: 

(a) Compute s; 

(b) Given g £ G, determine if g £ s + M; 

(c) Given h £M., compute ^{h) up to n bits in poly(n, logg) time; 

(d) Compute ^/W\- 

Proof: Corollary [1] implies that B"*- = H. Using this identity together with theorem [3)[i) , 
we find that supp(|0)) = s + H for some s £ G. By definition of H, for every h £ M there 

^Observe that vj can be considered as a function that hides the subgroup H in the sense of the hidden 
subgroup problem (HSP) [l3l - [lH |. That is, for every g,g' £ G we have = ^{g') iS g — g' £ H. Procedure 
l|50p is essentially the routine used in the quantum algorithm for HSP to prepare random coset states. 
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exists some element a{a,g,h) £ S. Using that a{a, g,h)\(j)) = we then have 



{s + h\(P) = {s + h\a{a,g,h)\(l)) = ^\s+h{9){s\(l)) 



(52) 



This imphes that \{s + /i|(/>)| = |(s|'/')| for all h £ M. Together with the property that 
supp(|0)) = s + H, it follows that can be written as 



for some complex phases S,{h). By suitably choosing an (irrelevant) global phase, w.l.o.g. 
we can assume that ^(0) = 1. 

We now show that the function h £ H ^ ^ (h) is quadratic. Using (|52I53|) we derive 



ah) = Vmis + h\cl>) = yWh"Xs+h{9){s\cP) = 7"X.+/.(9)C(0) = I'^Xs+hig)- (54) 



Since ^h) by definition only depends on h, the quantity ^""Xs+hio) only depends on h as well 
i.e. it is independent of a and g. Now select /ii,/i2 EH and associated stabilizer operators 
(Ti(ai,5'i,/ii), 0-2(02, 52, /12) e S. Then 



In (f56l) we used that (Tia2\4>) = \4>); in (I57M58P we used the definitions of Pauli operators and 
the fact that {s\4>) = ^(0); finally in ([59]) we used identity and the fact that ^(0) = 1. 
Now define B(hi, /12) = £,ihi + /i2)^(^i)C(/'-2)- We claim that i? is a bilinear function of H. 
To see this, note that the derivation above shows that B{hi, /12) = Xgi(^2)- Linearity in the 
second argument /i2 is immediate. Furthermore, by definition i? is a symmetric function i.e. 
B{hi,h2) = B{h2,hi). This shows that B is bilinear, as desired. 

We now address (a)-(d). As for (a) recall that s+H is the support of a stabilizer state \(p) 
is; theorem [3] then provides an efficient method to compute a suitable representative s. Note 
also that a generating set of HI can be computed efficiently owing to lemma [5j Statement 
(b) follows from lemma [2ja). Statement (d) follows from lemma [2jb). Finally we prove (c), 
by showing that the following procedure to compute ^(/i) is efficient, given any h £M: 

(i) determine some element a £ S such that a\s) oc \s + h); 

(ii) compute (s + /i|(t|s) = £,{h). 

To achieve (i), it suffices to determine an arbitrary stabilizer element of the form a = 
a{a,g,h) G S. Assume that generators ai{ai, gi, hi), . . . ,ar{ar, gr, hr) are given to us. We 
can then use algorithm (a) in lemma[2]to find integers Wi such that h = Wihi and, due to, 
a = ri'^r* operator of form a{a,g,h) for some values of a,g (use eq. [22]) . Moreover, 

given the Wi the label (a, g, h) of a can be computed efficiently; this accomplishes (i). Finally, 
it is straightforward that (ii) can be carried out efficiently: using formula ^(/i) = '^"'Xs+h{g) 
and standard algorithms to compute elementary functions [2^. ■ 




(53) 




(55) 
(56) 
(57) 
(58) 
(59) 



[i^'xs+hAai)] [r'xs+h.A92)] XgAh2)m 

i{hl)i{h2)XgAh2) 
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Theorem [S] generalizes result from flT^, ^Y\\ where analogous characterizations were given 
for qubits and qudits, although those works do not consider the notion of quadratic functions 
used here (furthermore their methods are completely different from ours). For example, in 



ref. 17| it was shown that every Pauli stabilizer state for qubits (corresponding to the group 



Z™) can be written as 



oc 



(^_iy{x)-l{x)^^^^y (60) 



Here 5 is a linear subspace of Z™, q{x) = Ax mod 2 is a quadratic form over Z2, and 
l{x) mod 2 is a linear form. This characterization indeed conforms with theorem [8) the set 
5 is a subgroup of Z^ and the function 

X G Z^ ^ i{x) := (_l)'?WiiW (61) 

is quadratic (see section 12. 3p . 

Theorem [5] also implies that every stabilizer state belongs to the family of Computation- 
ally Tractable states (CT states). A state IV') = X^V'gb) ^ is said to be CT (relative to 
its classical description) if the following properties are satisfied: 



(a) there exists an efficient randomized classical algorithm to sample the distribution 

(b) given g & G, the coefficient ipg can be computed efficiently with exponential precision. 



CT states form a basic component in a general class of quantum computations that can 
be simulated efficiently classically using probabilistic simulation methods. For example 
consider a quantum circuit C acting on a CT state and followed by a final standard basis 
measurement on one of the qubits. Then, regardless of which CT state is considered, such 
computation can be efficiently simulated classically when C is e.g. an arbitrary Clifford 



circuit, matchgate circuit, constant-depth circuit or sparse unitary. See 16[| for an extensive 
discussion of classical simulations with CT states. 

Here we show that every stabilizer state Itf^) G over a finite Abelian group G is CT. 
To be precise, we prove that such states are CT up to a global phase. That is, instead of (b) 
we prove a slightly weaker statement which takes into account the fact that any stabilizer 
state specified in terms of its stabilizer is only determined up to an overall phase. Formally, 
we consider the property 

(b') there exists an efficient classical algorithm that, on input g G G, computes a coeffi- 
cient ipg, where the collection of coefficients {^p'g : g £ G} is such that \^p) = i'glg) 
for some complex phase a. 

Corollary 4. Let be a stabilizer state over an Abelian group G, specified in terms of a 
generating set of polylog(0) stabilizers. Then {tp) is CT in the sense (a)-(b'). 

Proof: Property (a) was proved in [ij. To prove (b'), note that theorem [8] implies there 
exists a global phase a such that 

{a ■ }, • f f /i) if q = s + h for some /i G H 
if g ^M + s. 
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Using theorem [51[^b) it can be efficiently determined whether g belongs to H + s. If not, then 
{g\ip) = 0. If yes, then compute h : g — s; then ^(/i) can be computed owing to theorem 
[8)^c). Finally, y^|]HI| can be computed owing to theorem [8{d). 



A Proof of lemma [3] 

"Pro6/ems (a-e) in lemma\^ are polynomial-time reducible to either count- 
ing or finding solutions of systems of equations of the form A{x) = b; where A 
is a group homomorphism between two (canonically- decomposed) finite Abelian 
groups, Gsoi cmd G, to which x, b respectively belong; given that a matrix rep- 
resentation of A is provided." 

In the example given in section 12.51 we proved the proposition for the (d,e)th cases of 
lemma m to prove it for each of the remaining cases, (a-c), we will take similar steps. In the 
following, we define Ajj, Ax to be integer matrices whose columns are i.o. the elements of 
the sets {hi, . . . , hr} and {ki, . . . , kg}; the latter generate respectively H and K. Also, we 
denote by d the least common multiplier of di, . . . , dm- One can use condition p2p to check 
that the matrices Ah, Ak and define group homomorphisms from to G, if the 

value of t is respectively chosen to be r, s and r + s. 

We will show how to turn the problems (a-c) into system of the form Ax = b (mod G) 
such that G equals the original group G; Gsoi is chosen to be Z^, for some t; and A is an 
integer matrix that defines a group homomorphism from G to G^o/i 

(a) b belongs to H if and only if b can be obtained as a linear combination of elements 
of H, i.e., if and only if Ahx = b (mod G) has at least one solution x G Z^. Moreover, if 
one finds a particular solution vu, this element fulfills b = Ahw = '^w{i)hi (mod G). 

(b) The order of H is the number of distinct linear combinations of columns of Ah, 
which coincides with the order of the image of the group homomorphism Ah : — t- G. 
With this knowledge, it suffices to count the number of solutions of Ahx = (mod G), 
which equals kerA/;-. Then, one can compute \H\ = |imA//| = d'^ /\]ieT Ah\, where the 
latter identity comes from the first isomorphism theorem (iuiAh — Z^/kervl//). 

(c) g belongs to n i^T iff it can be simultaneously written as /i = ^ x{i)hi = ^ y{i)ki 
for some {x, y) G x Z^; or, equivalently, iff there exist an element (x, y) of the kernel of 
[74j^|A;<'] : Z^ X Z^ — )• G such that h = Ahx = —A^y (mod G). Thus, given a generating- 
set {{xi,yi)} of ker the elements gi := AnXi (mod G) generate HCiK, and, owing 
to, the problem reduces to finding solutions of [A/f|74/^] (p = (mod G). 

Finally, mind that r, s and r + s are ©(polylogg) due to the initial assumption that 
the generating-sets are poly-size, and that d is 0{did2 ■ ■ ■ dm) = 0(|G|); as a consequence, 
log |Gsoi|, log |G| are also O(polylogg); and, thus, we need ©(polylogg) memory to store the 
matrix A. It follows that the input-size of the new problem is ©(polylogg) and, therefore, 
we have reduced all problems (a-c) to systems of linear equations over finite Abelian groups 
in polynomial time. 



26 



B Proof of theorem [T] 



Given b & G = x • • • x and the mxn matrix A, which defines a group homomorphism 
from H = x • • • x Z^^ to G, we can see the system of Hnear equations Ax = b (mod G) 
as an 'inhomogeneous' system of congruences: 



Ax 



/ai(l) 02(1) 
ai(2) 02(2) 

\ai(m) 02 (m) 



an(l)\ 
a„(2) 

an{m)) 



(x{l)\ 
x{2) 



\x{n)j 



lh{l)\ 
6(2) 

V6(m)/ 



mod di 
mod d2 



mod dn 



6 (modG) (63) 



We will refer to A and to (I63p as our original matrix and our original system of equa- 
tions, the latter we aim to solve. Now, let us denote by d the least common multiplier of 
ci, . . . , c„, di, . . . , dm\ note that d is upper bounded by |-fr||G|. To solve ([631) . our approach 
will be, first, to transform (|63p into a slightly-larger system of congruences modulo d] second, 
to apply methods from computational number theory to deal with the latter. 



B.l Structure of the solutions and initial simplifications 

Let (xq, xi, . . . , Xr) be an r-tuple of elements of H such that xq is a particular solution of ([63]) 
and xi, . . . ,Xr generate ker ^; any tuple like (xq, xi, . . . , Xr) will be called a general solution 
since, due to (jlOp . the set Xg^i of solutions of ()63p is spanned by linear combinations of the 
form Xq + Y1 ^i^i- We will not impose restrictions on the integer r apart that it must be 
O (poly log |ff|). Using this notation, the system ([63]) is unsolvable if and only if its (unique) 
general solution is the empty tuple () — also known as the 0-tuple. 

We will now argue (in two steps), that the group where solutions must live, H, can be 
chosen w.l.o.g to be Z^, a simplification that will be exploited in subsequent sections. This 
is good enough for our purposes, since the order of this group is 0(polylog \H\): 

First, using (I12p and the fact that dg = for all elements g £ G, one readily sees that 
A defines a homomorphism A from Z^ to G H; therefore, the system Ax = b (mod G) with 
X G Z^ is linear and its solutions (if there is any) form a coset Xgoi = xq + ker A. 

Second, remark that H is a subset of Z^ and that every Cj divides d; as a result, the 
projection 7r(x) = x (mod H) is seen to be a (surjective) group homomorphism Z^ — t- 
using ()12p . Now we show that to solve ()63p we can, first, look for solutions x inside the 
bigger space ZJJ and, second, project them onto H using 7r(x). On the one hand, it is easy 
to see that for every solution x G Z^ the projected solution 7r(x) is also a solution: using 
x{i) = 7r(x)(i) -|- kci we derive 7r(x) = x — ^ hciCi and 

Att{x) = Ax -'^ kidOi = Ax = b (mod G). (64) 

In (I64p we used (I12p in the second equality. On the other hand, since we search for solutions 
inside a set larger than H and 7r(x) = x for every solution x G H, it follows 

Xsoi = = {vr(x) : Ax = b (mod G) ,x G Z^} (65) 

■^The new symbol is used to distinguish A from the original homomorphism A : H G. 
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Now, imagine we are given a general solution of the system (xg, xi, . . . , Xr) where all Xj E Z^. 
In view of above properties, it follows that the projected tuple (7r(xo), 7r(xi), . . . ,7r{xr)) is 
a general solution of (|63p: were the former general solution empty, we would conclude that 
([63]) admits no solution; and, moreover, projecting with vr reduces the number of distinct 
solutions by a multiplicative factor of | ker7r| = |(ci) x • • • x {cn)\ = (P/{ciC2 ■ ■ ■ c„) — to see 
this, we choose 6 = in (j65p . which leads to kerA = iunT^x^oi ~ -^Z '^ix^oi ■ 



B.2 Enlarging ( 1631) to a system of linear congruences 

In this section we show how to reduced our original system ()63p to a system of linear 
congruences, assuming that H = Z^. The first steps are rather standard: first, we 'undo' 
the modular equations of the initial system (j63p introducing m new integer variables and 
take remainder modulo d; the final system of equations will be denoted the enlarged system 
associated to 

Original system Enlarged system 

Ax = b (mod G) Ax = {A D) (^^^ = b mod d (66) 

xeH = a; G Z2 X 

Above, D = diag((ii, . . . ,dm) is a diagonal m x m integer matrix and, with little abuse 
of notation, we embedded the columns aj of A and b (originally elements of G) inside the 
larger group Zjp. Since the former group is a subset of the latter, this operation can be 
implemented via a rudimentary inclusion map from G to Z™. 

It is easy to check that the enlarged matrix A defines a group homomorphism from 
Z^ X Z™ to Z^, using (jl2p . Therefore, the enlarged system is a system of linear congruences 
modulo d. Owing to, the sets of solutions of the initial and the enlarged system ([661) . 
respectively denoted by Xgoi and Xsoi, have a coset structure 

Xsoi = xo + ker A, Xgoi = xq + ker A. (67) 

The following lemma shows that the solutions of the original and the enlarged system are 
intrinsically related, and gives a polylog(|G|, \H\) reduction of the former into the latter. 

Lemma 5. Let Xgoi and Xgoi be, respectively, the sets of solutions of the original and 
enlarged systems of linear congruences shown in 166\) . Then the following propositions hold: 

(a) The original system admits solutions iff the enlarged system admits solutions. 

(b) The solutions of the original system can be obtained from those of the enlarged system 
via 

Xsoi = tt{Xsoi), (68) 
where tt{x) := (a;(l), . . . , x{n)) is a surjective group homomorphism from Z^^"^ to Z^. 

(c) The cardinality of both sets are related through \Xsoi\ = 
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Remark that the lemma allows us to efficiently (a) decide whether the original system 
admits solutions, (b) find a general-solution for it and (c) count its number of solutions 
if an efficient subroutine to solve these problems for the enlarged system is provided: in 
particular, given a general-solution (xq, . . . , Xr) of (j66p . it follows that (7r(a;o), • • • , 7r{xr)) is 
a general-solution of ([63|) . 

The next theorem states, furthermore, that there are efficient classical algorithms to 
solve systems of linear equations modulo d. 

Theorem 9. Given a system of linear congruences Ax = b mod d where A G Z^^", 
b G and x £ ZJJ, there exist deterministic poly(m, n, log d) classical algorithms to solve 
the following tasks: (a) deciding whether the system admits solutions; (b) computing a 
general solution; (c) counting the number of different solutions. 

With this theorem, the proof of theorem [T] is completed; the remaining two sections are 
i.o. devoted to prove these last two results. 

B.3 Proof of lemma [5] 

We will first proof a smaller result. 

Lemma 6 (Kernel of a diagonal matrix). Given S G Z^^", a diagonal matrix whose 
r -first diagonal coefficients si, . . . ,Sr are positive integers and the rest are equal to zero; let 
5 : — Z^ be the group-homomorphism defined by S via matrix multiplication; then, the 
kernel of S fulfills 

ker5= (si) X ••• X (^,) X Z;^-*^ and | ker 5| = giga • • • (69) 
where qi := gcd{si, d) and Si = d/qi. 

Proof: Any x fulfilling Sx = mod d must satisfy r constrains Six{i) = kid for i < r and 
where the ki can be any integer. If we divide both sides by the qi, we can derive a new set 
of equivalent modular constrains 

—x(i) = mod — , for alH < r 
Qi Qi 

Now, each number (si/qi) is coprime to di/qi; hence, each (si/qi) has an inverse element in 
'^di/qi ^-iid can be removed from the constrain where it appears multiplying it by the latter. 
It follows that the possible values for x{i) are the multiples of s'i = d/qi inside Z^, proving 
the first equation; the second equation, follows as a consequence, for \d/qi\ = qi. ■ 

We prove now lemma [5](b), which also implies (a) 

For every x G Xsoi we can define a tuple yx G Z^ coefficient-wise as 

y^[i) ■= [b - Ax] {i)/di mod d. (70) 

It follows easily that all elements with the form a; = ( ) where x G Xsoi belong to Xsoi , by 
checking [74|Z)]a; = b mod d. Moreover each x satisfies x = tt{x) and, thence, it follows that 
^sol ^ T^iXgoi)- We finish the proof of (b) showing that the inclusion Xgoi 2 T^iXgoi) also 
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holds. The strategy is now to prove that for every ^ = {y) ^ ^soi the element x = ^(x) 
belongs to Xgoi, which can be shown as follows: 

Ax = Ax + Dy = b mod d =^ Ax{i) = b{i) — y{i)di + kid for all i = 1, . . . , m (71) 

Since di divides d, the last two terms are modulo dj. Thus, Ax{i) = b{i) mod di for every 
i, and we are done. 

Finally, we prove lemma [5](c) 

Every pair elements of Xg^i that are mapped to x via tt must have the form xi = (^J , 
X2 = (^) where D{yi — 7/2) = mod d. Therefore, exactly |kerD| distinct elements of 
Xgoi are mapped to x, for any value of x. Applying lemma E] to D, it follows |Xsoi| = 
I ker DllXgoil = did2 - • • dm\Xsoi\, as desired. 



B.4 Proof of theorem [9] 

We will use existing algorithms to compute the Smith normal form of A over the integers 



modulo d [2j]: these return an m x m matrix U and an n x n matrix V, both invertible, 
such that S := UAV is diagonal and its first r diagonal coefficients are non-zero (with r 
depending of the particular problem). Instead of Ax = b mod d we will solve the system 
Sy = c mod d with c = Ub mod d: since V is an invertible homomorphism, it follows that 
yQ is a solution of this system iff Vy^ is a solution of the initial system; owing to, if we solve 
(a-b-c) for the new 'diagonal' system we are done. 

Finally, recall that we can use the extended Euclidean algorithm to decide the solvability 
of any linear congruence Siy{i) = c{i) mod d, and find (if it exists) a particular solution yo- 
These facts, together with lemma [H (which shows how to obtain a generating-set of ker 5"), 
let us compute a general-solution of Sy = c mod d. Moreover, the number of solutions of 
the system — either or | kerS"! — can also be computed due to lemma [6l 
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